116222 matches found
Exploit for Improper Input Validation in Google Chrome
--- CVE-2026-11112 – XXE via SVG Image Upload Program C...
CVE-2026-66902: Improper Neutralization of Special Elements used in an OS Command
Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...
PT-2026-67855
Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.06 Description An issue exists where the software executes a command specified in an external account credentials JSON file through an ungated system call. The Pluggable subclass retrieves the credential...
A Security-Oriented Lifecycle Model for Large Language Model Systems
Large language models are being integrated into critical infrastructure and enterprise workflows at unprecedented scale,yet the lifecycle frameworks governing their development and operations were designed for operational efficiency rather than security analysis. As a result, security-relevant...
CVE-2026-67979
NASA cFS v7.0.1 is vulnerable to incorrect access control within the Executive Services dynamic application start path component. This security flaw allows an attacker to achieve arbitrary code execution by placing a shared object on the target storage. No specific exploit links or remediation in...
CVE-2026-49131 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field
OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14512, CVE-2026-14528)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14446)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14529)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066
Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...
CVE-2026-59913
Dell Display and Peripheral Manager DDPM Mac, versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...
Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift
AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
CVE-2026-18610
CVE-2026-18610 affects NewType WebEIP up to v3.0, impacting an unknown part of the file /EIP_Com_FileList.aspx. The issue enables improper authentication and can be exploited remotely; the exploit is public. Vendor did not respond to disclosure. No remediation details are provided in the availabl...
JLSEC-2026-1108
A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex caused by a maliciously crafted file may lead to an application crash...
dvwa-webapp-vapt
dvwa-webapp-vapt Black-box penetration test of D...
EUVD-2026-52263
Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...
Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
Summary IBM Maximo Application Suite uses axios-1.15.2.tgz, protobufjs-8.0.1.tgz, protobufjs-8.2.0.tgz and undici-7.26.0.tgz which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-54270, CVE-2026-45740,...
WordPress Remote API plugin <= 0.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Pedro Pinho in WordPress Plugin Remote API versions = 0.2...
Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs
Summary IBM Maximo Application Suite - Predict Component uses aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525...